This invention relates to providing security in communication networks. In particular, the invention relates to firewall technology in packet switched networks for adaptively providing a plurality of security levels.
Referring to FIG. 1, a typical firewall 101 is placed between a Local Area Network (LAN) 103 and outside networks 111, 115. LAN 103 may include a plurality of internal hosts 105, 107, 109. Outside networks 111 can be networked through the Internet 117. Outside network 115 may also include its own firewall 117. Internal hosts 105, 107, 109 and remote hosts 119, 121 are computers, e.g., personal computers (PC) or computer workstations. Firewall 101 includes a combination of computer hardware and software components configured to protect LAN 103, i.e., preventing unwanted intrusions from outside networks 111, 115.
In order to exchange information, e.g., sending a message from remote host 119 to internal host 105, a connection 125 is established by sending a plurality of packets therebetween. A packet is a basic message unit routed between a source computer and a destination computer, e.g., remote host 119 and internal host 105, respectively, in a packet-switched network depicted in FIG. 1. For example, when a file, e.g., an e-mail message, HTML file, or other similar message, is sent from a source computer to a destination computer, the file is broken into a plurality of packets. (Here, HTML, Hypertext Markup Language, is a set of xe2x80x9cmarkupxe2x80x9d symbols or codes, which instructs a Web browser how to display a Web page""s words and images.)
More specifically, a Transport Control Protocol (TCP) module of a TCP/IP layer in a source computer divides the file into packets of an efficient size for transmitting over the network. Each packet includes header information, e.g., a destination address and a source address, and content information, i.e., the broken up message file. Further, the plurality of packets from the file includes a plurality of connection control packets and data transfer packets. The connection control packets include at least one connection establishing packet, e.g., a SYN packet, and at least one connection disconnection packet, e.g., RST, FIN, FIN-ACK packets. The data transfer packets include the pieces of the broken up file. Individual packets for a given file may travel different routes through the packet switching network. When the packets from one file have all arrived at their destination computer, they are reassembled into the original file by a TCP module in the destination computer.
Here, the TCP module is a communication protocol used along with the Internet Protocol (IP) to send data in the form of packets between a source and destination computers. While the IP module performs the actual delivery of the data, the TCP module keeps track of the individual packets that a file is divided into for efficient routing through the Internet.
OSI (Open Systems Interconnection) is briefly described here to provide the context in which the present invention is discussed later. OSI is a reference model for the layer of common functions in a communications system. Although many existing hardware and software products have been developed on a slightly different model, the OSI model is often used as a guideline when new products are designed and serves as a common reference for understanding any particular design or comparing it with others.
OSI includes seven layers:
The application layer (layer 7) is a layer at which a user interacts with a computer to view messages or send data requests or responses.
The presentation layer (layer 6) is a layer, usually part of an operating system, that converts incoming and outgoing data from one presentation format to another (e.g., converting a text stream into a popup window with a newly arrived text string).
The session layer (layer 5) manages the establishment of a continuing series of requests and responses between the applications at each end of a communication connection.
The transport layer (layer 4) manages the end-to-end control (e.g., determining whether all packets have arrived) and error-checking.
The network layer (layer 3) handles the routing of the data (sending it in the right direction to the right destination on outgoing transmissions and receiving incoming transmissions at the packet level).
The link (or data-link) layer (layer 2) provides error control and synchronization for the physical level and does bit-stuffing for strings of 1""s in excess of 5.
The physical layer (layer 1) conveys the bit stream through the network at the electrical and mechanical level.
Referring back to FIG. 1, the basic task of firewall 101 is to separate internal network 103 from outside networks 117, 115 and enforce security policies with a set of rules. The most common firewall features include: securing internal network 103 access with a perimeter defense, controlling all connections into and out of internal network 103, filtering packets according to previously defined rules, xe2x80x9cauthenticatingxe2x80x9d or making sure users and applications are permitted to access resources, logging of activities, and actively notifying the appropriate people when suspicious events occur.
Conventional firewalls include only one of a packet filter, an application proxy and a stateful inspection.
A packet filter examines each incoming packet and decides what actions to take by checking against a table of access control rules. The packet filter, in its simpler embodiments, examines the header information of each incoming packet and makes pass/fail decisions based on their source and destination addresses. A weakness of such a firewall is that the content information of the packets is unknown to the firewall. More specifically, because packet filters perform their checking at the network access layer, there is no real knowledge of application level vulnerabilities. As a result, direct connections are allowed between a source and destination computers through firewall 101, exposing internal hosts 105, 107, 109 to direct attacks.
An application proxy does not allow direct contact between a xe2x80x98trustedxe2x80x99 and xe2x80x98untrustedxe2x80x99 networks. Each of the packets passing through this type of firewall is examined at the application layerxe2x80x94meaning the application proxies understand the destination and contents of packets. Such a firewall, for example, distinguishes between xe2x80x9cFTP Putxe2x80x9d and xe2x80x9cGetxe2x80x9d commands. A typical application proxy includes a built-in proxy function also known as a transparency function. The transparency function replaces the IP address of a host on the internal protected network with its own IP address for all traffic passing through. The transparency function provides added security, because it hides the addresses of internal hosts. This makes it more difficult for hackers on the outside to target specific devices inside such a firewall. For this higher security, however, the application proxy requires large amounts of processing power and a corresponding loss of performance.
Finally, a stateful packet filter examines packets without examining the packets as well as that of an application proxy. After a packet filter firewall or stateful inspection firewall has decided to allow a connection to be made, it allows data to travel directly between the networks without further inspection. Once a session is opened, the nature of the session can be changed without being detected. This allows for more speed, but also creates potential security risks as well. Again, making internal hosts 105, 107, 109 vulnerable to attacks from outside.
Accordingly, there exists a need for a firewall method which makes it possible to dynamically select the best procedures from existing firewall methods to achieve the required level of security while meeting performance constraints.
Further, the definitions of network communication terms and phases can be found in Andrew S. Tannenbaum, xe2x80x9cComputer Networks xe2x80x9d 2nd ed., (1989), the contents of which are herein incorporated by reference. Information on network programming can also be found in W. Richard Stevens, xe2x80x9cUnix Network Programmingxe2x80x9d (1990), the contents of which are herein incorporated by reference.
The firewall of the present invention combines the advantages provided in the conventional firewall technologies described above while eliminating short comings thereof. In other words, the firewall of the present invention is just as secure as a proxy firewall, but it is more flexible and efficient.
More specifically, the firewall of the present invention is provided between an internal computer network to be protected by the firewall and at least one outside network. The firewall includes a dynamic packet filter which communicates with a proxy. The proxy registers with the dynamic packet filter for notifications of request to establish new data communication connections through physical connections between the internal and outside computer networks. When a connection establishing request is received, in the form of a SYN packet, the dynamic packet filter notifies the proxy and provides attribute information thereto. The attribute information includes the source and destination addresses and the physical connection on which the packet was received.
In order to determine whether to allow the requested data communication connection, the proxy compares the attribute information with rules in a configuration information file. The rules in the configuration information file are entered by a user to set forth whether to allow data communication connections for certain physical connections. If the rule is to allow the data communication connection and forward the packets at the packet level, the dynamic packet filter creates a connection rule so as to apply the connection rule to packets having the same attribute information. Subsequent packets received with the same attribute information are then automatically forwarded without consulting the proxy. Once the connection terminates, the connection rule is removed and the proxy is notified. However, if the decision is to absorb, the dynamic packet filter sends the packets up a TCP/IP stack in the firewall, where they will be accepted by the proxy.
In other words, the proxy acts as the server to the incoming connection and initiates a new connection, acting as a client, to the ultimate destination. In between, the necessary application-level filtering is performed.
An added benefit of the present invention, beyond the performance improvement, is the flexibility it gives its users. Within the adaptive proxy model, a firewall can be configured to follow more or less stringent security rules, fine-tuning performance even more.